1. A method for distributed computation of an RSA inverse value (y) in an asynchronous 
network from at least two input values (x, e) among n-\ participating network devices 
comprising t < n/4 faulty devices and a non-faulty leader device, the participating network 
devices holding share values of the Euler function (<p(N)) of an RSA modulus (TV), each 
participating network device performing the steps of: 

(a) choosing a first random value (q) and a second random value (r); 

(b) sharing over integers (Z) the first random value (q\ the second random value (r), and 
the zero value (0); 

(c) the leader device performing additionally the steps of: 

(i) receiving a first, second, and third sub-share value (q h r„ 0,) from at least t + 1 
participating network devices; 

(ii) broadcasting the identities of said participating network devices; 

(d) receiving the identities and corresponding sub-share values (#, ,, r„ 0,); 

(e) deriving a sum-share value (F) from one of the share values, the at least one input 
value (e\ and the corresponding first, second and third sub-share values (q h r h 0,) defined 
by the identities, 

(f) broadcasting the sum-share value (F)\ 

(g) receiving 2f + 1 sum-share values (Fi); 

(h) deriving a polynomial (/) interpolating the sum-share values (Fi) and an exponent 
share value (d P ) dependent on the polynomial (/), and an inverse-share value (yp) 
dependent on the exponent share value (d P ) and the RSA modulus (AO; 

(i) broadcasting the inverse-share value (y P ); 
(j) receiving t + 1 inverse-share values (yi)\ and 

(k) obtaining the RSA inverse value (y) from the received inverse-share value (yi). 
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2. A method according to claim 1 to compute the RSA inverse value (y), wherein among n 
participating network devices (A, B, C, D) comprising t < nIA faulty devices at least / + 1 
participating network devices (A, B, C, D) act as a leader device while performing n 
times the steps of claim 1 . 

5 3. A method according to claim 2, wherein each participating network device (A, B, C, D) 
performs the steps of: 

in the event of obtaining or receiving one RSA inverse value (y), determining the 
validity of the obtained RSA inverse value (y) under use of the at least two input 
values (x, e), and 

10 in the event of positive determination, broadcasting the RSA inverse value (y) and 

stopping further calculations. 

4. A method according to claim 1, wherein the step (II) of sharing over integers (Z) 
comprises using a threshold signature for determining the consistency of subsequently 
received sub-share values (q i9 r h 0<). 

15 5. A method according to claim 1, wherein the step (II) of sharing over integers (Z) 
comprises using a vector of digital signatures for determining the consistency of 
subsequently received sub-share values (q i9 r i9 0,). 

6. A method according to claim 1, wherein the step (VIE) of deriving an exponent share 
value (dp) comprises using the Extended Euclidean Algorithm. 

20 7. A method according to claim 1, wherein the step (XI) of obtaining the RSA inverse value 
(y) from the received inverse-share value (y,) comprises using the Lagrange Interpolation 
Algorithm. 

8. A plurality of program storage devices, each readable by at least one digital processing 
apparatus and having a program of instructions which are tangibly embodied in the 
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storage devices and which are executable by the at least one processing apparatus to 
perform a method for distributed computation of an RSA inverse value (y), in an 
asynchronous network from at least two input values (x, e) among n-\ participating 
network devices (A, B, C) comprising t < n/4 faulty devices and a non-faulty leader 
device (D), the participating network devices (A, B, C, D) holding share values ( 
<Pa,(P B,(p c,(p d) of the Euler function {(p{N)) of an RSA modulus (AO, said program 
allowing each participating network device to perform the following steps: 

(a) choosing a first random value (q) and a second random value (r); 

(b) sharing over integers (Z) the first random value (q), the second random value (r), 
and the zero value (0); 

(c) the leader device (D) performing additionally the steps of: 

(i) receiving a first, second, and third sub-share value (q h r h 0,) from at least t + 1 
participating network devices; 

(ii) broadcasting the identities (S) of said participating network devices; 

(d) receiving the identities (S) and corresponding sub-share values (q i%9 r h 0,); 

(e) deriving a sum-share value (F) from the share value {(p P ), the at least one input 
value (e), and the corresponding sub-share values (q h r h 0/) defined by the identities 
GS), 

(f) broadcasting the sum-share value (F); 

(g) receiving 2t + 1 sum-share values (F/); 

(h) deriving a polynomial (/) interpolating the sum-share values (F { ) and an exponent 
share value (d P ) dependent on the polynomial (/), and an inverse-share value (y P ) 
dependent on the exponent share value (d P ) and the RSA modulus (AO; 

(i) broadcasting the inverse-share value {y P )\ 
(j) receiving t + 1 inverse-share value (y,); and 

(k) obtaining the RSA inverse value (y) from the received inverse-share value (y t ). 
CH920020056US1 21 



